Certificate chains

GEThttps://api.kennmarq.com/v1/certificate

Our public certificate chains, in PEM: the live and test signing chains, and the time-stamp server's. No key needed.

All chains, as JSON

curl

curl https://api.kennmarq.com/v1/certificate

200 application/json

{
  "object": "certificates",
  "signing": {
    "live": "-----BEGIN CERTIFICATE-----\n…",
    "test": "-----BEGIN CERTIFICATE-----\n…"
  },
  "tsa": "-----BEGIN CERTIFICATE-----\n…"
}

One chain, as a PEM file

Add ?chain=live, ?chain=test or ?chain=tsa for one chain as application/x-pem-file:

curl

curl "https://api.kennmarq.com/v1/certificate?chain=tsa" -o kennmarq.com-tsa-chain.pem

Caching

Answers may be cached for 5 minutes (Cache-Control: public, max-age=300). Chains change rarely: when we rotate a certificate, the changelog says so in advance.

Our signing certificates come from our own certificate authority (O=Neuramare, C=CH) until C2PA conformance and a publicly trusted certificate are in place. Until then C2PA readers show signatures as valid from an unknown signer; these chains let you check them yourself.